ADF security

Question

As we know that there are 3 types of integration runtime (IR) can be chosen for data factory.
If we trying to use azure hosted IR, we will require to either allow all azure service to access the database or whitelist all the possible IP range for data factory.
In term of security, will this action exposed the database to possible risk?
Is there any suggestion how we to counter this risk?

If I wanted to use azure hosted IR with VNET integration, does it mean that the current database I am using will be required to have private end point features so that we could create a private link to connect with this azure hosted IR with VNET?

Answer 1

Hello @Yang Chowmun ,

Thanks for the question and using MS Q&A platform.

As per the Security considerations for data movement in Azure Data Factory: If the cloud data store supports HTTPS or TLS, all data transfers between data movement services in Data Factory and a cloud data store are via secure channel HTTPS or TLS.

Data encryption in transit: All connections to Azure SQL Database and Azure Synapse Analytics require encryption (SSL/TLS) while data is in transit to and from the database. When you're authoring a pipeline by using JSON, add the encryption property and set it to true in the connection string. For Azure Storage, you can use HTTPS in the connection string.

Data encryption at rest: Azure SQL Database also supports transparent data encryption (TDE), which helps protect against the threat of malicious activity by performing real-time encryption and decryption of the data, without requiring changes to the application.

If I wanted to use azure hosted IR with VNET integration, does it mean that the current database I am using will be required to have private end point features so that we could create a private link to connect with this azure hosted IR with VNET?

When you create an Azure Integration Runtime (IR) within Azure Data Factory Managed Virtual Network (VNET), the integration runtime will be provisioned with the managed Virtual Network and will leverage private endpoints to securely connect to supported data stores.

It's recommended that you create Managed private endpoints to connect to all your Azure data sources.

For more details, refer to Azure Data Factory Managed Virtual Network (preview).

Hope this will help. Please let us know if any further queries.

------------------------------

• Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
• Want a reminder to come back and check responses? Here is how to subscribe to a notification
• If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators